CVE-2026-96613

Medium6.5 Published on Oct 2, 2026

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device.

CVSS score6.5 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-862

Vulnerabilities

Meari OpenAPI Authorization Gaps Expose Device Controls and Sensitive Data

CISA disclosed two Meari OpenAPI authorization flaws enabling authenticated users to alter device configs and access shadows, with no fix planned.

Oct 2, 202609:24 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Meari OpenAPI Authorization Gaps Expose Device Controls and Sensitive Data